We have updated to v4.8.0-alpha.3+mementomods-2026-10-11-security, which means today's Mastodon security fixes cherry-picked on top of our 11.10.2026 build.🔒 Security
- Fixed insufficient ActivityPub identifier verification. Mastodon decides what to trust based on which server something comes from, and a redirect to another domain could get around that check (https://github.com/mastodon/mastodon/security/advisories/GHSA-288h-6j8h-6x5j).
- Extra checks on the keys other servers use to sign what they send us.
- Updated dependencies with security advisories: excon, css_parser, pghero, sanitize and aws-sdk-s3.
- Ruby was updated to 4.0.9.
🧭 Mastodon v5 status
Mastodon v5 with its new design is still in alpha, and Mastodon Bird UI is not ready for it yet. Progress updates under hashtag #MastodonBirdUI and this thread: https://mementomori.social/@rolle/117496541666081314
Until both are ready, we stay on our 11.10.2026 build and pick only the security fixes on top of it.
Source code: https://github.com/mementomori-social/mastodon
As always, if you notice anything unusual or buggy, please reach out to me or any of the admins. Enjoy your time here, and feel free to message me with any questions or thoughts.
If anything feels off, please let us know!
#MementoMoriSocial #Mastodon #MastoAdmin
nostr:note1r7alnzhug7sh6r5j67w545w864ql73a52cprhz3grxr8g42q5crsftf750